A company must build a site-to-site VPN between its Cisco Secure Firewall and a partner's firewall from a different vendor. Which choice gives the best chance of interoperability?
Select an answer to reveal the explanation.
Short Explanation
When two people don't share a language, you pick the one everyone learns in school. For VPNs that's standards-based IPsec with IKEv2 — every serious firewall speaks it. The trap is Cisco overlays like DMVPN; they're great between Cisco boxes but not a universal language.
Full Explanation
IPsec and IKEv2 are IETF standards implemented by virtually every enterprise firewall vendor, which makes them the default for cross-vendor site-to-site VPNs. Interoperability depends on matching parameters on both sides: IKE version, encryption, integrity, Diffie-Hellman group, lifetimes, authentication method, and the protected traffic definition. Policy-based tunnels must have mirrored traffic selectors, while route-based tunnels typically use any-to-any selectors with routing deciding what enters the tunnel; both ends must agree on which style is used. DMVPN is a Cisco overlay combining mGRE and NHRP, and while other vendors offer comparable features, it is not implemented identically across vendors, so it does not maximize interoperability. GETVPN relies on GDOI and Cisco's key server and group member implementation, and it is designed for private WANs, so it is a poor fit for a partner connection across the internet. Cisco Secure Client is remote access software for endpoints, not a peer protocol that another vendor's firewall can run to form a site-to-site link. Exam caveat: mismatched traffic selectors are the most common cross-vendor failure, typically appearing as a Phase 2 failure after Phase 1 succeeds. Operational check: exchange a written parameter sheet with the partner, bring the tunnel up, and confirm both Phase 1 and Phase 2 security associations with traffic counters increasing.